Show HN: Wardkey – Only approved apps get your Git and AWS keys(Windows)

Category: security

Tags: credential-broker, windows-hello, git, aws-cli, security, go

Score: 7.0/10 (Innovation: 7, Technical: 8, Documentation: 7, Utility: 6)

Wardkey is an experimental Windows-only credential broker that gates Git and AWS CLI secrets behind local policy and optional Windows Hello approval, verifying the requesting process identity via named pipes. It stores credentials in an encrypted vault with Argon2id and XChaCha20-Poly1305, and logs decisions to an HMAC-chained audit log. The application-aware credential release model is a genuinely interesting approach to reducing blast radius from compromised developer tools.

Target audience: backend devs, devops, security engineers

Repository: https://github.com/Annora998/Wardkey · Go · NOASSERTION

View on Hacker News